Petty Cash City of York Council Internal Audit Report 2016/17

Business Unit: Customer & Business Support Services Responsible Officer: Director of Customer Business and Support Services Service Manager: Head of Customer, Resident and Exchequer Services Date Issued: 06/10/2016 Status: Final Reference: 10330/009

| Actions | P1 | P2 | P3 | |---------|----|----|----| | Overall Audit Opinion | Substantial Assurance | Summary and Overall Conclusions

Introduction Petty cash and cash advances fall under the remit of Transactional Services. This audit engagement was originally a component of the Cashiers audit for 2015-16, however it was agreed to cover this aspect in more detail in a separate audit. There are 83 separate petty cash funds of varying sizes across the 6 directorates (including the now abolished OCE), with a total value of £46k. ACE, CBSS, OCE and CES – have a relatively small impress of £2.3k - £4.1k, whilst CANS and AS have an impress of £16.8k and £16k respectively. These higher limits present greater risk and so will be the focus of this audit. Cash is a liquid commodity that is easier to lose or be misappropriated. This makes it a high risk area, and therefore assurance is necessary that adequate controls are present and utilised.

Objectives and Scope of the Audit The purpose of this audit was to provide assurance to management that procedures and controls within the system ensure that:

- There is a centralised and total reconciliation of all petty cash funds
- Petty cash and cash advances are administered correctly – with adequate records for each transaction, showing adherence to petty cash policy (authorisation and reconciliation.)
- Petty cash and cash advance funds are kept securely
- Transactions are appropriately keyed into, and reconciled with, the general ledger
- Related policy documents are adequate and up to date

Key Findings The audit found that the central administration and reconciliation of petty cash funds and cash advances, as carried out by the transactional services team was good. All transactions tested were appropriately input into, and reconciled to the general ledger. The petty cash arrangements at the sites tested were also found to be well managed. There were two small issues identified within the audit.

- The petty cash and payment procedure notes are out of date, having last been updated in 2010
- One specific site, where the access to the petty cash is not restricted to certain designated staff

Overall Conclusions It was found that the arrangements for managing risk were good with few weaknesses identified. An effective control environment is in operation, but there is scope for further improvement in the areas identified. Our overall opinion of the controls within the system at the time of the audit was that they provided Substantial Assurance.

### Issue/Control Weakness

| The current procedure notes have not been reviewed for over 5 years. |

### Risk

The policy in place may not reflect current best practice. This could lead to inconsistent practices and ineffective administration of petty cash.

### Findings

The current Petty Cash and Payments Procedures available to council staff on the council’s intranet are dated June 2010. Since then there have been updates to a number of financial regulation and policies which have therefore not been reflected within the current document. Whilst the content of the document is comprehensive it may not reflect any recent changes or protocols to the financial regulation and procedures for the council.

Additionally, the majority of the “useful” links section within the document no longer worked.

### Agreed Action 1.1

The document has not been reviewed for some time and it is agreed that it needs reviewing and updating. This will be completed within the time scale of 1st October 2016.

| Priority | 3 | |----------|---| | Responsible Officer | Head of Customer, Resident & Exchequer Services | | Timescale | 1 October 2016 | 2 Access to petty cash at a council site

| Issue/Control Weakness | Risk | |------------------------|------| | All staff at a council site had access to a large petty cash fund. | This raises the risk of theft as there are not designated members of staff that can access and distribute petty cash, and there is less accountability over the cash. |

Findings

All petty cash funds were kept secure at the sites visited as part of the audit.

However, the access arrangements for one fund highlighted the need for improved access to large petty cash funds. Currently all staff at that site have access to the full amount of the fund as, at that establishment, petty cash is required on a 24 hour basis by any member of staff on duty. There is a risk that the full petty cash fund is compromised through mal-administration. Consideration should be given to have a second petty cash fund available to all staff of a smaller amount, which can be topped up from the larger petty cash fund as and when required. The main petty cash fund access would therefore be better controlled by fewer officers.

Agreed Action 2.1

Access to the safe will be restricted to the Management Team only: three Team Leaders, a Business Support Assistant and the Manager.

A second petty cash fund will be introduced, with a smaller amount that may be required when no management are on site.

| Priority | 3 | |----------|---| | Responsible Officer | The Manager – The Glen Family Centre | | Timescale | 1 October 2016 | Audit Opinions and Priorities for Actions

Audit Opinions

Audit work is based on sampling transactions to test the operation of systems. It cannot guarantee the elimination of fraud or error. Our opinion is based on the risks we identify at the time of the audit.

Our overall audit opinion is based on 5 grades of opinion, as set out below.

| Opinion | Assessment of internal control | |------------------|-------------------------------------------------------------------------------------------------| | High Assurance | Overall, very good management of risk. An effective control environment appears to be in operation. | | Substantial Assurance | Overall, good management of risk with few weaknesses identified. An effective control environment is in operation but there is scope for further improvement in the areas identified. | | Reasonable Assurance | Overall, satisfactory management of risk with a number of weaknesses identified. An acceptable control environment is in operation but there are a number of improvements that could be made. | | Limited Assurance | Overall, poor management of risk with significant control weaknesses in key areas and major improvements required before an effective control environment will be in operation. | | No Assurance | Overall, there is a fundamental failure in control and risks are not being effectively managed. A number of key areas require substantial improvement to protect the system from error and abuse. |

Priorities for Actions

| Priority | Description | |----------|-----------------------------------------------------------------------------| | Priority 1 | A fundamental system weakness, which presents unacceptable risk to the system objectives and requires urgent attention by management. | | Priority 2 | A significant system weakness, whose impact or frequency presents risks to the system objectives, which needs to be addressed by management. | | Priority 3 | The system objectives are not exposed to significant risk, but the issue merits attention by management. | Where information resulting from audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.